CVE-2023-4700 — Missing Authorization in Gitlab

CWE-862 — Missing AuthorizationCWE-284 — Improper Access Control4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 99.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedNov 6

Description

An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab14.7 — 16.3.6+1
▶NVDgitlab/gitlab14.7.0 — 16.3.6+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-j8mj-5fpw-2pc8: An authorization issue affecting GitLab EE affecting all versions from 14↗2023-11-06
▶

📋Vendor Advisories

2
GitLab
CVE-2023-4700: An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a↗2023-11-06
▶
Debian
CVE-2023-4700: gitlab - An authorization issue affecting GitLab EE affecting all versions from 14.7 prio...↗2023
▶